Privacy
Method notes / your data
Privacy policy
Last updated: [DATE] · Effective from: [DATE]
This app does not use accounts, analytics, or advertising. Getting in takes one shared password, not a personal login. It stores the minimum needed to keep your magazines private to your own browser and to build the magazine you asked for. This page explains exactly what that is.
Who is responsible for your data
[OPERATOR NAME] is the data controller for this service, reachable at [CONTACT EMAIL]. This app is hosted within the EU on [HOSTING PROVIDER / LOCATION]; your data is not transferred outside the EU.
What we store, and why
- An anonymous browser identifier
- The first time you use the app, it sets a random, unguessable id in a cookie (
mm_owner) so it can tell your magazines apart from anyone else's. It carries no name, email, or other identity — it is a bare key into our database, not a tracking cookie, and is never sent to any analytics or advertising service (we use none). It stays until you clear cookies or up to five years, whichever comes first. - A record that you entered the password
- Once you type the shared password, the app sets a second cookie (
mm_gate) so it does not ask again on this device. It holds only an expiry date and a signature proving the app issued it, nothing about you, and lasts one year or until the password changes. - The photos you upload
- Kept so the app can build and re-render your magazine. Photos may contain images of identifiable people and — like most camera files — embedded EXIF metadata, which can include the exact time and GPS location the photo was taken. We do not read, use, or share that location data; it simply travels with the file as your camera wrote it. If a photo carries location data you would rather not keep on our server, please remove it before uploading.
- Signals derived from your photos
- To lay pages out well, the app measures sharpness, colour palette, likely crop points, and where faces appear in a photo. Faces are found on our own server, never sent anywhere else, and stored only as rectangles used to keep people in frame. Nothing identifies who is in the photo, and no facial recognition or biometric matching is performed or stored.
- A one-time "continue on another device" link
- If you use this feature, a random single-use code is created linking to your browser id. It expires after ten minutes or first use, whichever comes first, and is not retained after that.
- Standard hosting logs
- Like virtually any web server, our hosting infrastructure may briefly log IP addresses and request details for security and operational purposes (e.g. detecting abuse), independent of anything this app itself stores.
Why we're allowed to process this
We process the above only to provide the magazine-building service you are actively using — there is nothing here used for profiling, advertising, or any purpose beyond that. Where GDPR requires a legal basis, this is performance of the service you've requested (Art. 6(1)(b)) and, for the anonymous cookie itself, our legitimate interest in keeping one visitor's magazines separate from another's (Art. 6(1)(f)).
How long we keep it
Your magazines, photos, and exports are kept until you delete them. Deleting a magazine permanently removes it, every photo you uploaded to it, and any exported files — immediately, not after a grace period.
Who else sees it
Nobody. We do not sell, rent, or share your photos or magazines with any third party, and we run no analytics, advertising, or tracking scripts on this site.
Your rights
Under GDPR you can ask to access, correct, or erase your data, or object to how it's processed. In practice, the fastest way to exercise most of these is the Delete button beside each magazine, which erases everything immediately and completely. For anything else, or to raise a concern, contact [CONTACT EMAIL]. You may also lodge a complaint with your local data protection authority.
Security
The browser identifier is stored in an httpOnly cookie, unreachable by page scripts, and the site should always be reached over HTTPS in production. No system is perfectly secure; if you believe you've found a vulnerability, please contact [CONTACT EMAIL] directly rather than filing a public report.
Children
This app is not directed at, and should not be used by, anyone under 16.
Changes to this policy
If this policy changes materially, the "last updated" date above will change with it.